Azure built-in roles · ai machine learning

This page's changes and edits · All guidance changes

Microsoft's edit · 15 May 20:13 UTC

rename foundry rbac roles

Microsoft's commit message in MicrosoftDocs/azure-docs · commit 1e19317 · +13 ~~−13~~ lines · also on GitHub

⋯ 15 unchanged lines

1616 This article lists the Azure built-in roles in the AI + machine learning category.

1717

1818

19 −## Azure AI Account Owner

19 +## Foundry Account Owner

2020

21 −Grants full access to manage AI projects and accounts. Includes an ABAC condition to constrain role assignments. Grants conditional assignment of the Azure AI User role to other user principles. Applies for new Foundry resources.

21 +Grants full access to manage AI projects and accounts. Includes an ABAC condition to constrain role assignments. Grants conditional assignment of the Foundry User role to other user principles. Applies for new Foundry resources.

2222

2323 [Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)

2424

⋯ 27 unchanged lines

5252 > | **NotDataActions** | |

5353 > | *none* | |

5454 > | **Condition** | |

55 −> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) | Add or remove role assignments for the following roles:<br/>Azure AI User |

55 +> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) | Add or remove role assignments for the following roles:<br/>Foundry User |

5656

5757 ```json

5858 {

5959 "assignableScopes": [

6060 "/"

6161 ],

62 − "description": "Grants full access to manage AI projects and accounts. Grants conditional assignment of the Azure AI User role to other user principles.",

62 + "description": "Grants full access to manage AI projects and accounts. Grants conditional assignment of the Foundry User role to other user principles.",

6363 "id": "/providers/Microsoft.Authorization/roleDefinitions/e47c6f54-e4a2-4754-9501-8e0985b135e1",

6464 "name": "e47c6f54-e4a2-4754-9501-8e0985b135e1",

6565 "permissions": [

⋯ 27 unchanged lines

9393 "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d}))"

9494 }

9595 ],

96 − "roleName": "Azure AI Account Owner",

96 + "roleName": "Foundry Account Owner",

9797 "roleType": "BuiltInRole",

9898 "type": "Microsoft.Authorization/roleDefinitions"

9999 }

⋯ 459 unchanged lines

559559 }

560560 ```

561561

562 −## Azure AI Owner

562 +## Foundry Owner

563563

564564 Grants full to manage AI project and accounts. Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project. Applies for new Foundry resources.

565565

⋯ 64 unchanged lines

630630 "notDataActions": []

631631 }

632632 ],

633 − "roleName": "Azure AI Owner",

633 + "roleName": "Foundry Owner",

634634 "roleType": "BuiltInRole",

635635 "type": "Microsoft.Authorization/roleDefinitions"

636636 }

637637 ```

638638

639 −## Azure AI Project Manager

639 +## Foundry Project Manager

640640

641 −Lets you perform developer actions and management actions on Foundry Projects. Includes an ABAC condition to constrain role assignments. Allows for making role assignments, but limited to Azure AI User role. Applies for new Foundry resources.

641 +Lets you perform developer actions and management actions on Foundry Projects. Includes an ABAC condition to constrain role assignments. Allows for making role assignments, but limited to Foundry User role. Applies for new Foundry resources.

642642

643643 [Learn more](/azure/ai-foundry/concepts/rbac-azure-ai-foundry)

644644

⋯ 16 unchanged lines

661661 > | **NotDataActions** | |

662662 > | *none* | |

663663 > | **Condition** | |

664 −> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) | Add or remove role assignments for the following roles:<br/>Azure AI User |

664 +> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) | Add or remove role assignments for the following roles:<br/>Foundry User |

665665

666666 ```json

667667 {

⋯ 25 unchanged lines

693693 "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{53ca6127-db72-4b80-b1b0-d745d6d5456d}))"

694694 }

695695 ],

696 − "roleName": "Azure AI Project Manager",

696 + "roleName": "Foundry Project Manager",

697697 "roleType": "BuiltInRole",

698698 "type": "Microsoft.Authorization/roleDefinitions"

699699 }

700700 ```

701701

702 −## Azure AI User

702 +## Foundry User

703703

704704 Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project.

705705

⋯ 56 unchanged lines

762762 "notDataActions": []

763763 }

764764 ],

765 − "roleName": "Azure AI User",

765 + "roleName": "Foundry User",

766766 "roleType": "BuiltInRole",

767767 "type": "Microsoft.Authorization/roleDefinitions"

768768 }

⋯ 2086 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 08:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.